Tyre pressure monitoring devices enforcing range limitation on communication

ABSTRACT

A tyre monitoring device, tyre monitoring system and method including a wireless interface having range determining capability and a processor. The processor: receives a command via the wireless interface from a second device of the tyre monitoring system; determines a range to the second device; and executes the command if the range to the second device is less than a predetermined threshold.

RELATED APPLICATION

This application claims priority to and incorporates by reference UnitedKingdom patent application GB2019744.8, filed Dec. 15, 2020.

TECHNICAL FIELD

The present disclosure relates to a tyre monitoring system and methodsof its operation. In examples, the present disclosure relates to anaircraft tyre monitoring system, such as an aircraft tyre pressuremonitoring system.

BACKGROUND

Checking tyre pressure is an important part of the maintenance of avehicle. Tyre pressures should be maintained at predetermined pressuresto ensure that a tyre performs as intended by the manufacturer.Incorrect tyre pressure can lead to a tyre failing, perhaps bursting andcausing damage to the vehicle and/or a loss of control. Due to the highspeeds encountered by the tyres on aircraft landing gear, pressures arechecked regularly, perhaps once a day or more frequently. Manualchecking of tyre pressure takes time, reducing this time is beneficial.

It has been proposed to automate tyre pressure measurement by included asensing device in a wheel which can then be interrogated wirelessly toprovide a measurement of tyre pressure. This can reduce the timerequired compared to a manual reading but requires security measures,such as encryption keys, because the wireless channel is broadcastoutside the aircraft.

SUMMARY

According to a first aspect, there is provided a tyre monitoring devicefor use in a tyre monitoring system. The tyre monitoring devicecomprises: a wireless interface having range determining capability; anda processor. The processor is configured to receive a command via thewireless interface from a second device of the tyre monitoring system;determine a range to the second device; and execute the command if therange to the second device is less than a predetermined threshold.

According to a second aspect, there is provided a tyre monitoring devicefor use in a tyre monitoring system. The tyre monitoring devicecomprises: a wireless interface having range determining capability; anda processor. The processor is configured to: receive data via thewireless interface from a second device of the tyre monitoring system;determine a range to the second device; and reject the data if the rangeto the second device is greater than a predetermined threshold.Optionally, the processor is configured to: receive a command via thewireless interface from a third device of the tyre monitoring system;determine a range to the third device; and action the command if therange to the third device is less than a predetermined threshold.

Optionally, the tyre monitoring device is configured to be mounted on anaircraft wheel.

According to a third aspect, there is provided a tyre monitoring systemcomprising a plurality of tyre monitoring devices as discussed above,with or without optional features.

Optionally, the tyre monitoring system comprises a control devicecomprising a wireless communication interface having range determiningcapability.

According to a fourth aspect, there is provided a method for a wirelesstyre monitoring device. The method comprises receiving a command via awireless interface from a second device of the tyre monitoring system;determining a range to the second device; and actioning the command ifthe range to the second device is less than a predetermined threshold.

According to a fifth aspect, there is provided a method for a wirelesstyre monitoring device. The method comprises: receiving data via thewireless interface from a second device of the tyre monitoring system;determining a range to the second device; and rejecting the data if therange to the second device is greater than a predetermined threshold.Optionally, the method further comprises: receive a command via thewireless interface from a third device of the tyre monitoring system;determine a range to the third device; and action the command if therange to the third device is less than a predetermined threshold.

Optionally, in any of the above aspects, the wireless interfacecomprises an ultra-wideband (UWB) interface.

Optionally, in any of the above aspects, the predetermined threshold isless than or equal to 40 m.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 shows a schematic representation of a tyre monitoring systemaccording to a first example of the invention.

FIG. 2 shows a schematic representation of a tyre monitoring device foruse in the example of FIG. 1.

FIG. 3 shows a schematic representation of a control device for use inthe example of FIG. 1.

FIG. 4 shows a schematic representation of a configuration device foruse in the example of FIG. 1.

FIG. 5 shows a schematic representation of a tyre pressure sensornetwork installed in an aircraft.

FIG. 6 shows a flow chart of a tyre pressure check process that can beused with the example of FIG. 1.

FIG. 7 shows a flow chart of a tyre pressure check process that can beused by the tyre monitoring device of FIG. 2.

FIG. 8 shows a flow chart of a process for enforcing a communicationrange on received commands or data.

DETAILED DESCRIPTION

In the following description, for purposes of explanation, numerousspecific details of certain examples are set forth. Reference in thespecification to “an example” or similar language means that aparticular feature, structure, or characteristic described in connectionwith the example is included in at least that one example, but notnecessarily in other examples.

Certain methods and systems described herein relate to the operation ofa sensor network in an aircraft, such as a network of tyre monitoringdevices. In examples described herein, references to “aircraft” includeall kinds of aircraft, such as fixed wing, for example military orcommercial aircraft, or unmanned aerial vehicles (UAVs), and rotary wingaircraft, for example helicopters.

According to examples herein, tyre monitoring devices forming part of atyre monitoring system provide an indication of the status on the tyremonitoring device itself. For example, an indication of the status maybe provided by a light, with the colour of the light giving informationof the status. A confirmation of the status indicated on the tyremonitoring devices is provided as an input to a control device where itcan be compared to status data received from the tyre monitoring devicesthemselves. In this way, various human factors may be addressed in theuse of the system. When the input is from a user of the system, it meansthat the user must pay attention to the indication on the devicesthemselves and not just the information displayed on the control device.This can be important when the indication on the tyre monitoring deviceshas been certified to a desired Development assurance level (DAL) butthe indication on the control device has not. It can also address humanerror factors such as viewing an incorrect aircraft, when several are inclose proximity As a further advantage, an error may be identified ifthe user input does not match that displayed on the devices themselves.

In some examples, once the status of the indicator on the tyremonitoring device has been confirmed by the input (in other words theindicator on the tyre monitoring device and the input are bothdetermined to represent the same status) the indicators on the tyremonitoring devices can be switched off. This can lead to power savings,because the indicator does not have to be active for as long. Forexample, the indicator may be a high intensity LED to allow viewing inbright sunlight. An example of a high intensity LED is the VishayTLCR5200, a red LED commercially available from Vishay. This LED has atypical luminous intensity of 4000 mcd but dissipates 135 mW, so usefulenergy savings can be obtained by deactivating it sooner than an overallsystem timeout. Such energy savings may be particularly useful when thepower source of the tyre monitoring device has finite energy reserves,such as a battery, because it will then have a direct impact on the lifeof the tyre monitoring device.

Example Tyre Monitoring System

FIG. 1 shows a schematic representation of a tyre monitoring system, inthis case a pressure sensor system according to a first example. Thesystem comprises a plurality of tyre monitoring devices 10, a controldevice 12 and a configuration device 14, all of which are arranged tocommunicate via wireless communication. A tyre monitoring device ismounted on each wheel of a vehicle, in this case an aircraft (asexplained in more detail below, with reference to FIG. 5). The controldevice 12 is separate from the tyre pressure sensors 10 and may be adedicated control device which functions only in the tyre pressuresensor system, or a computing device which can also be used for otherpurposes than with the tyre pressure sensor system. Example computingdevices include mobile devices such as laptops, tablets, cellular phonesand wireless communication devices.

The wireless communications in the tyre pressure sensor system of FIG. 1may use a local area network or a personal area network and can have anysuitable topography, including centralized and mesh wireless systems. Incentralized systems, a single device may be nominated as a master deviceto coordinate communications, or one or more additional wireless accesspoints, gateways or controllers (not shown) may be used. In someexamples, the tyre monitoring devices 10, control device 12 andconfiguration device 14 may all communicate using the same wirelesstechnology and form a single network. In other examples one or more ofthe tyre monitoring devices 10, control device 12 and configurationdevice 14 may be separated from other elements of the system. Suchseparation may be provided in software, for example by providing asuitable firewall and/or the use of different network IDs and encryptionkeys. Such separation may also be provided by hardware, for example bydifferent wireless communication technology. Both hardware and softwareseparation may be combined. For example, in the system of FIG. 1, thecontrol device communicates with the tyre sensing devices with adifferent wireless communication technology than the configuration,which may improve the security of the system.

FIG. 2 shows a schematic representation of a tyre monitoring device 10for use in the tyre pressure sensor system of FIG. 1. The tyremonitoring device 10 is configured for mounting on a wheel, for exampleby a mechanical connection to an opening on the wheel providing accessto the tyre. The tyre monitoring device 10 includes a processor 200, awireless communication interface 202, an indicator 204, a power supply206, and a pressure sensor 208, a temperature sensor 209, a firststorage 210 and a second storage 211.

Processor 200 may be any suitable processing device including amicroprocessor with one or more processing cores. In use, processor 200coordinates and controls the other components and may be operative toread and/or write computer program instructions and data from/to thestorage 210, 211. The processor may be optimized for low power operationor have at least one processing core optimized for low power operationin some examples.

Wireless communication interface 202 is connected to the processor 200and is used to both transmit and received data from the other devices ofthe tyre pressure sensor system. In this example, the wirelesscommunication interface includes two transceivers, 212, 214 which bothuse different wireless technology. A first transceiver 212 is providedfor relatively long-range communication, up to about 50 m or about 100m. For example, the first transceiver may use a communication standardsuitable for mobile devices, such as IEEE 802.15.1, IEEE 802.15.4, IEEE802.11 (Wi-Fi) on either the 2.4 GHz or 5 GHz Industrial Scientific andMedical (ISM) bands or a Wireless Avionics Intra-Communications (WAIC)standard. The first transceiver also includes an encryption module forencrypting sent data and decrypting received data, for example accordingto the Advanced Encryption Standard (AES) utilizing pre-shared keys. Asecond transceiver 214 is provided for relatively short-rangecommunications. For example, the second transceiver 214 may use astandard according to IEEE 802.15, such as IEEE 802.15.4, RFID or NearField Communication (NFC). The second transceiver may operate over arange of less than 5 m, less than 3 m, less than 1 m, less than 50 cm,less than 25 cm, less than 10 cm, less than 5 cm, less than 1 cm orrequiring contact between devices. Like the first transceiver 212, thesecond transceiver 214 also includes an encryption module for encryptingsent data and decrypting received data.

In some examples, a single wireless transceiver may be provided in thewireless communication interface. In that case the single transceivermay use relatively short range or relatively long range communication,or adjust the range (such as by controlling transmit power) as required.

Indicator 204 is connected to the processor 200 and controlled by theprocessor 200 to provide indications to a user of the tyre pressuresensor system. In this example the indicator is an LED, but in otherexamples the indicator is another form of light, a display, such as anLCD or e-ink display, or any other form of visual indication. In otherexamples, the indicator is an audible indicator, such as a buzzer,beeper, speaker or any other sound generating component. In furtherexamples, the indicator can comprise both audible and visual indicationcomponents. The indicator provides at least first and secondindications, for example a first colour and a second colour of emittedlight. Further indications can also be provided, such as solid orflashing light. The tyre monitoring device has a housing (not shown) andthe indicator 204 can provide an indication outside the housing, forexample the LED may be mounted external to the housing or visiblethrough the housing, or sound may be able to be emitted from within thehousing.

The power supply 206 provides power to the elements of the sensingdevice. It may be a battery, such as Lithium battery. In this example,the power supply is a Lithium battery with power sufficient to run thesensor in normal operation for about 2 to 3 years. In other examples thepower supply may comprise a power harvesting system, for exampleharvesting vibration and/or electromagnetic radiation to charge acapacitor or battery which is then used to power the device.

In use, the wireless sensing device may spend much of its operationallife in “sleep” or low power mode, with most of the components otherthan the processor and wireless communication interface powered off.This can conserve battery life. For example, the tyre monitoring devicemay be by default in a low power mode, listening for a command tomeasure or report tyre pressure. As tyre pressure readings are likely tobe required relatively rarely, perhaps as little as once every 10 days,once every 5 days, once every 3 days or once per day, this can provideuseful power savings. In other examples, pressure may be sensed morefrequently for example every 10 minutes, 15 minutes, 20 minutes, 30minutes, 1 hour or 2 hours and stored for use in trend monitoring.

The pressure sensor 208 is connected to processor 200 and may be anysuitable sensor for measuring pressure, for example a capacitive sensor.Similarly, the temperature sensor 209 is connected to processor 200 andmay be any suitable sensor for measuring temperature, such asthermocouple. The temperature sensor 209 may be arranged to measure thetemperature of the wheel or the temperature of the gas inside the tyredirectly. Where the temperature sensor 209 measures the temperature ofthe wheel, this can be processed to determine the temperature of the gasin the tyre. For example, an algorithm or look-up table may be used.

The connection of the pressure sensor 208 and temperature sensor 209 tothe processor 200 may be digital, providing a digital representation ofthe measured pressure and/or temperature from an Analogue to DigitalConvertor (ADC) in the sensor itself, or analogue, in which case theprocessor may include an ADC to sample the received signal. Includingboth a pressure sensor and a temperature may be useful to determine atemperature compensated pressure value. Although this example includes apressure sensor and a temperature sensor, other examples may includeonly a pressure sensor, or may include further sensors.

This example includes two storage elements 210 and 211. Storage 210 isnon-volatile rewritable storage in this example, such as flash memorywhich can retain data without requiring applied power. Other examplesmay include volatile storage, which is kept powered by the power supply,or combinations of read-only and rewritable storage. Storage 210 isconnected to the processor 200 and used to store both computer programinstructions for execution by the processor and data, such as data fromthe pressure sensor 208 or received over the wireless communicationinterface 202. In some examples, storage 210 may store a history ofpressure and/or temperature readings sensed by the pressure sensor 208and the temperature sensor 209. For example, the previous ten daysreadings may be stored, with the newest data replacing the oldest oncethe storage is full.

Storage 211 is secure storage to which write and/or read access isrestricted, for example only accessible to certain processes running onprocessor 200. Configuration data, such as wireless encryption keys canbe stored in storage 211. In other examples, a single storage may beprovided, or storage 210 and 211 may be provided in a single physicaldevice with a logical partitioning between storage 210 and storage 211.

FIG. 3 shows a schematic representation of a control device 12 for usein the example of FIG. 1. The control device 12 includes a processor300, a display 302, an input system 304, a power supply 306, a wirelessinterface 308, a storage 310 and wired communication interface 312. Inthis example the control device is a mobile device, such as a cellularphone or a tablet computer.

The processor 300 is any suitable processing device, for example amultipurpose microprocessor, system-on-chip, or system in package, whichmay include one or more processing cores. Processor 300 is connected tothe display 302, such an LCD, OLED or e-ink display to displayinformation to a user of the control device.

Input system 304 includes a touch screen interface in this example,allowing a user to interact with the control device by touching userinterface elements on the screen. The input system 304 may include oneor more buttons in addition to the touch screen, as well as other inputdevices, such as a microphone for speech recognition and a camera forimage input. Other examples may not include a touch screen interface.

The control device is powered by power supply 306, which is arechargeable lithium-ion battery in this example. Other examples may usealternative power supplies, such as other battery technologies, mainspower, or energy harvesting, such as solar power.

A wireless interface 308 is included for the control device 12 tocommunicate with other devices in the tyre pressure sensor system. Inthis example, a single wireless interface 308 is provided which isconfigured to communicate with the tyre monitoring devices 10. Forexample, a relatively long range wireless communication technology canbe used, such as one conforming to IEEE 802.15.1, IEEE 802.15.4 or IEEE802.11. This allows the control device 12 to interact with the tyremonitoring devices from a relatively long range.

In other examples, the control device may be provided with multiplewireless communication interfaces or transceivers, operating withdifferent wireless technologies, such as at least two of IEEE 802.15.1,IEEE 802.15.4, IEEE 802.11 (Wi-Fi 33), WAIC, RFID and NFC. For example,the control device may have two transceivers with one having a longercommunication range than the other.

Storage 310 includes a non-volatile element, such as flash memory, and avolatile element, such as RAM. The non-volatile element is used to storeoperating system software and application software. In this example, thecontrol device runs standard operating system software and is loadedwith application software to interact with the tyre pressure sensorsystem. In order to restrict access to the tyre pressure sensor network,the application software may be provided from a secure source and notavailable to the general public, and/or require credentials to beentered before operating.

Wired communication interface 312 is provided for connection to acomputing system. The wired communication interface 312 can be forexample, a serial data connection, such as Universal Serial Bus (USB), aparallel data connection or a network connection, such as Ethernet. Thewired communication interface 312 may allow the control device tocommunicate values and/or other status information read from the tyremonitoring devices to the computing system, for example to store longterm trends and assist fleet management. Alternatively, or additionally,wireless communication interface 308 may be used for communication withthe computing system. In some examples, the control device may notinclude a wired communication interface.

FIG. 4 shows a schematic representation of a configuration device 14 foruse in the example of FIG. 1. The configuration device 14 includesgenerally the same elements as the control device 12: a processor 400,display 402, input system 404, power supply 406, wireless interface 408,storage 410 and wired communication interface 412 and these aregenerally the same as described above for the control device, unlessdescribed otherwise below. In this example the configuration device is amobile device but is restricted to operate only with the tyre monitoringsystem. For example, the configuration device may be a computing deviceor tablet which can only run software for interaction with the tyremonitoring system.

The wireless communication interface 408 of the configuration device inthis example is a relatively short-range communication system, forexample IEEE 802.15.1, IEEE 802.15.4, NFC or RFID. This allows theconfiguration device to act as an additional authentication factor whenconfiguring the tyre monitoring devices, for example the tyre monitoringdevice may only respond to configuration commands received from theconfiguration device or may only respond to configuration commandsreceived from the control device after a command received from theconfiguration device.

In other examples, the configuration device may include multiplewireless communication interfaces or transceivers. For example, theconfiguration device may include a transceiver for relatively shortrange communications as discussed above and a transceiver for relativelylong-range communications, such as one conforming to IEEE 802.11.

The wired communication interface 412 of the configuration device may beused to provide information to the configuration device in a securemanner, for example enabling some encryption keys to be updated over awired interface, such as a serial data connection, rather than awireless interface.

In some examples, the configuration device 14 may be omitted and itsplace taken by the control device 12. The control device 12 may comprisea short range wireless communication interface, such as one conformingto IEEE, 802.15.1, IEEE 802.15.4, RFID or NFC. Application software maybe loaded onto the control device to allow the control device to alsofunction as an additional authentication factor, perhaps through themaintenance of cryptographic keys which can only be accessed withsuitable credentials to control the operation of the short rangewireless communication interface for the transmission of configurationcommands In these examples, separate application software may beprovided on the control device which can be executed to cause thecontrol device to function as a configuration device.

FIG. 5 shows a schematic representation of a tyre pressure sensornetwork installed in an aircraft. The aircraft 500 comprises a fuselage510, wings 520, main landing gear 530 and nose landing gear 540.According to an example, the aircraft 500 comprises a sensor networkaccording to any of the examples described herein. The aircraft 500 maybe used in conjunction with any of the methods described herein.According to an example, a plurality of wireless nodes are distributedat various locations around the aircraft 500. For example, in thelanding gear 530, 540, the wings 520, and in the fuselage 510. Tyremonitoring devices are installed on each wheel of the main landing gear530 and nose landing gear 540.

In an example, the tyre monitoring devices 10 are also in communicationwith a cockpit system to provide tyre pressure information to the pilotson the flight deck. In these examples, the flight deck console may alsofunction as a control device.

Example Tyre Pressure Check Processes

FIG. 6 shows a flow chart of a tyre pressure check process that can beused with the example of FIG. 1. First, at block 602, a user launchesthe tyre monitoring control application on the control device 12. Duringinitialization of the application, a check is made that the wirelesscommunication interface 308 for communication with the monitoringdevices is active on the control device and the user is prompted toactivate if it is not active.

Next, at block 604, the control device scans for tyre monitoring devicesin range. For example, the control device may send out a probe over thewireless communication interface which causes any tyre monitoringdevices in range to respond with an indication of their vehicleidentifier, such as tail identifier of an aircraft to which the tyremonitoring device is attached. The scanning may comprise establishingdirect, point-to-point contact with each tyre monitoring device, orcontact through the network of tyre monitoring devices, for examplethrough an access point, a master device, or any device in a meshnetwork. The scanning may comprise waking the tyre monitoring devicesfrom a low power mode. The scanning may comprise using a secure networkkey to communicate with the sensor network.

Depending on the communication range and location, tyre monitoringdevices associated with more than one vehicle may be detected. Forexample, several aircraft may be in the same hanger in range of thecontrol device. Next, at block 606, it is determined whether anidentifier should be selected automatically, without requiring usinginput. For example, the application may store a configuration optionwhether an identifier should be selected automatically or not. Ifautomatic selection is not required, the process continues to block 608.If automatic selection is required, the process continues to block 612.In some examples, block 606 is not included. In these examples, theprocess can continue with either manual selection or automatic selectionas explained below.

For manual selection, at block 608, the control device displays theidentifiers of detected vehicles. At block 610, input is received of aselected identifier, for example from a user selection of the desiredidentifier.

For automatic selection, at block 612 a vehicle identifier isautomatically selected from amongst the identifiers indicated in thereceived responses. The can be done in various ways. For example, wheneach tyre monitoring device in range responds individually to thecontrol device, at least two responses may be from tyre monitoringdevices associated with the same vehicle identifier. In that case, thevehicle identifier associated with the largest number of responses mayselected automatically because that is likely to be the vehicle closestto the control device for which pressure measurement is required. Inanother example, the vehicle identifier of the tyre monitoring deviceclosest to the control device may be selected, for example a responsehaving a greatest Received Signal Strength Indication (RSSI). In afurther example, all detected tyre monitoring devices may be associatedwith the same vehicle identifier, in which case that is selected.

Next, at block 614, a command is sent to the tyre monitoring devicescorresponding to the selected identifier to cause them to read thepressures and report back to the control device, for example they mayexecute a process as described below with reference to FIG. 7.

Responses are received from the tyre monitoring devices at block 616 anddisplayed on the control device at block 618. The display of pressuresmay include one or both of a numerical value and a status indicationsuch as “OK” or “Low Pressure”.

At block 620 a cross check of the received data may be made to ensuredata consistency. The process then ends.

Throughout the process of FIG. 6, communication between the controldevice and the sensor devices may be secure, for example encrypted by anetwork key. The network key for the communication with the controldevice may be different from the network key used for communicationbetween the sensor devices to enhance the security of the system.

Security may be increased by using a wireless communication technologywith a limited transmission distance when exchanging secure keys, forexample 802.11 (Wi-Fi) standards may allow transmission over a distanceof 50 m or further in clear space. In some examples, security may beincreased by reducing transmission power, or using a low distancetechnology such as NFC or RFID, when encryption keys are transmittedcompared to transmission of the encrypted data itself, requiring closerproximity for the initial key exchange process. Distance boundingtechniques could also be introduced which, when combined with ultra-wideband radio communication, the distance of the communicating equipmentcan be securely measured, ensuring that the interaction is happeningwithin a secure perimeter of the equipment, this is discussed furtherwith reference to FIG. 8 below.

FIG. 7 shows a flow chart of tyre pressure check process that can beused by the tyre monitoring device of FIG. 2. This process is providedto provide additional assurance and fault tolerance in the pressuremeasurements from the system, for example to guard against corruptoperation or errors in the control device. Through this process, themonitoring device uses its indicator to provide an indication of tyrepressure status independent of the control device. In some examples, theindication of tyre pressure status by the monitoring device may have ahigher Development Assurance Level (DAL) than the indication provided onthe control device. For example, although the control device may be usedto initiate a tyre pressure measurement and provide a convenient meansfor a user to understand the results of the measurement it may not haveDAL certification, while the operation of the monitoring device toprovide the indication using the indicator on the monitoring device maybe certified to Development Assurance Level B. This may allow the systemto operate with a wide range of control devices, because certificationof those devices to a DAL is not required, but still ensure that thesystem as a whole meets required safety standards. Similarly, in someexamples the monitoring device may have a higher Security AssuranceLevel (SAL) than the control device.

First, at block 702, a tyre monitoring device receives a command tocheck pressures over the wireless communication interface from thecontrol device. In response, at block 704, the processor uses thepressure sensor to measure the pressure in the tyre. The measuredpressure is then compared against the reference pressure in block 706 todetermine whether the tyre has low pressure. In this example lowpressure occurs if the pressure sensed by the pressure sensor is lessthan 89% of the reference pressure. Other examples may determine a lowpressure when the measured pressure is less than 95%, less than 90% orless than 85% of the reference pressure. Further examples may determinea low pressure when the measured pressure is at least about 207 kPa(about 30 psi) less than the reference pressure. Other examples maydetermine a low pressure when the measured pressure is at least about138 kPa (about 20 psi), or about 69 kPa (about 10 psi) less than thereference pressure. If low pressure is detected, execution proceeds toblock 708, otherwise execution proceeds to block 712.

At block 708, the processor uses the indicator to indicate a faultcondition, for example by providing a solid red light for apredetermined period. The predetermined period may be 5 minutes, 2minutes, 1 minute, or 30 seconds, for example. The processor alsobroadcasts a fault indication to the other tyre monitoring devices atblock 712, again using the wireless communication interface.

At block 712, the processor checks to see whether any fault messagesfrom other tyre monitoring devices have been received via the wirelesscommunication interface. Such fault messages may be received directly,via other tyre monitoring devices or through a hub or access point. Inthis example, such fault messages are received without first beingrequested, following the receipt of the command in block 704. In otherexamples, the fault message may be received responsive to a statusenquiry sent by the tyre monitoring device to the other tyre monitoringdevices. If any fault messages are received, execution proceeds to block714, where the processor uses the indicator to display a faultcondition. For example, the fault indication may be the same as thatused in block 708. In other examples, the fault indication may bedifferent than that used in block 708, for example a second faultindication such as a flashing red light for a predetermined period. Byusing the second fault indication, the tyre monitoring device canindicate a fault in another tyre yet signal that its own measuredpressure is not low.

If no fault messages are received at block 712, execution proceeds toblock 716 where the processor uses the indicator to provide an “OK”indication. For example, by providing a solid green light for apredetermined period. The predetermined period may be 5 minutes, 2minutes, 1 minute, or 30 seconds, for example. In this way, the “OK”indication is only given when all tyre monitoring devices havedetermined that the pressure of their associated tyre is not low andthat they have not received an indication of a fault from another of thetyre monitoring devices.

Finally, at block 718, the data of the measured tyre pressure istransmitted to the control device in response to the command This datamay include further information such as stored reference pressure,determined status, and wheel position. Transmission of additionalinformation may allow verification of the correct operation of the tyremonitoring device and a check that the configuration data stored in thestorage has not changed or has been set up correctly. The transmissionin block 718 may be sent directly to a control device 12, to anothertyre monitoring device 10 for onward routing, or to an access point orother wireless node.

With the method of FIG. 7, confirmation of tyre pressure status isprovided by the tyre monitoring devices themselves. A fault in anysensor causes all sensors to indicate a fault. In this way, the tyremonitoring devices may be certified according to a required DAL and/orSAL using the indication on the tyre monitoring devices themselveswithout requiring the control device to also be certified.

In other examples, rather than transmitting a fault indication at block710, all tyre monitoring devices may instead transmit their measuredpressure to other tyre monitoring devices. Received pressures may thenbe independently checked by each independent tyre monitoring device todetermine whether faults exist. This may guard against a fault in asensor which does not indicate a low pressure condition, for example ifthe stored reference pressure has become corrupted.

In further examples, the tyre monitoring device may transmit an “OK”status notification when it is determined that the tyre pressure is notlow in block 706. Such examples may provide assurance that all sensorsare operating correctly, because if no data is received from one of theother tyre monitoring devices it is indicative of a malfunction or faultin that tyre monitoring device.

Although the processes above describe the use of a general mobile deviceas a control device, the control device may also be a dedicated deviceprovided only for use with the tyre monitoring system, or with thevehicle more generally. This may improve security as greater control isavailable.

Although the processes above describe the use of an indicator which is alight, other examples may use other indicators, such as displays and/oraudio components. For example, rather than simply display a solid orflashing colour, a display may also display information of the measuredpressure itself. Where audio and visual indicators are both provided,some indications may not use both the audio and visual indicator. Forexample, an “OK” indication may use only the visual indicator, with theaudio indicator only activated on a fault.

Distance Limitations for Increased Security

The use of wireless communication can bring an increased security riskbecause the wireless channel is more easily accessible to third parties.Encryption of messages exchanged between devices in the tyre monitoringsystem makes it harder to malicious devices to eavesdrop or injectmalicious commands or data without knowledge of the encryption key. Asmentioned above, limiting the distance of communication can also improvesecurity. Such a limitation in distance may be inherent in the wirelesscommunication protocol, for example NFC and RFID typically operate overranges of less than 30 cm. Other wireless communication protocols, suchas WiFi or 802.11 protocols might have a range of around 50 m in clearspace or lower if the transmission power is limited. Nevertheless, evenwhen transmission power limits communication range, it does not providea clearly defined boundary. Range can be extended by using a directionalantenna to increase sensitivity, for example.

In this embodiment a distance criterion is used at a tyre monitoringdevice. When communication takes place, the range or distance to thedevice in communication is determined and assessed against the distancecriterion. If the range is greater than a threshold distance thencommunication is ceased, and any commands or data received are notprocessed. Alternatively, commands or data received may only beprocessed if the range is lower than the threshold distance. For generaluse with a tire monitoring system, a suitable threshold distance is 40m, 30 m or 25 m. Security against malicious attacks is improved becausephysical proximity is enforced.

A lower threshold distance may be used for particular types of command,such as configuration commands and/or exchange of encryption keys. Inthis case, the distance threshold may be 1 m, 50 cm, 25 cm or 5 cm, forexample.

Any suitable technology can be used to determine the range. The wirelesscommunication protocol itself can include range-finding technology. Forexample, Ultra-Wideband (UWB) communication includes range determinationas part of the protocol stack. Range or distance is preferablydetermined actively, for example by using time of flight measurement,along with exchange of range data between transmitting and receivingdevices, such as defined in IEEE 802.15.4a or IEEE 802.15.4z.

An example method to use an enforced distance limitation to improve thesecurity of a tyre pressure check process, such as that as describedwith reference to FIG. 7, will now be explained. This method can be usedto decide whether to a execute or action a command received over awireless interface at block 702, or whether data received from othersensors, such as fault messages at block 712, should be processed orrejected.

FIG. 8 depicts an example method which can be used to enforce a distancelimitation. First, at block 802, a tyre monitoring device receives acommand and/or data via a wireless interface from another device of thetyre monitoring system. This may be from another tyre monitoring device(such as for received data) or a control device (such as for commands)In this example, the data is received over a UWB wireless interface.

Next at block 804, a range to the second device is determined. Anysuitable range-finding technology can be used. For example,time-of-flight methods in which the devices exchange range finding data,calculate a time of flight and compute a range provides accurate rangemeasurements which are difficult to spoof.

Once the range is determined, it is determined whether range is under apredetermined distance threshold at block 806. If the range is under thethreshold, execution proceeds to block 808 where the command is actionedor the data is processed, as appropriate. If the range is above thethreshold, then the method ends at block 810. In some examples, an alertcan be provided such as by flashing the indicator or the tyre monitoringdevice to show that potentially malicious commands or data have beenreceived before the method ends at 810.

The above examples are to be understood as illustrative examples of theinvention. It is to be understood that any feature described in relationto any one example may be used alone, or in combination with otherfeatures described, and may also be used in combination with one or morefeatures of any other of the examples, or any combination of any otherof the examples. Furthermore, equivalents and modifications notdescribed above may also be employed without departing from the scope ofthe invention, which is defined in the accompanying claims.

While at least one exemplary embodiment of the present invention(s) isdisclosed herein, it should be understood that modifications,substitutions and alternatives may be apparent to one of ordinary skillin the art and can be made without departing from the scope of thisdisclosure. This disclosure is intended to cover any adaptations orvariations of the exemplary embodiment(s). In addition, in thisdisclosure, the terms “comprise” or “comprising” do not exclude otherelements or steps, the terms “a” or “one” do not exclude a pluralnumber, and the term “or” means either or both. Furthermore,characteristics or steps which have been described may also be used incombination with other characteristics or steps and in any order unlessthe disclosure or context suggests otherwise. This disclosure herebyincorporates by reference the complete disclosure of any patent orapplication from which it claims benefit or priority.

The invention is:
 1. A tyre monitoring device for use in a tyremonitoring system, the tyre monitoring device comprising: a wirelessinterface having range determining capability; and a processorconfigured to: receive a command via the wireless interface from asecond device of the tyre monitoring system; determine a range to thesecond device; and execute the command if the range to the second deviceis less than a predetermined threshold.
 2. A tyre monitoring device foruse in a tyre monitoring system, the tyre monitoring device comprising:a wireless interface having range determining capability; and aprocessor configured to: receive data via the wireless interface from asecond device of the tyre monitoring system; determine a range to thesecond device; and reject the data if the range to the second device isgreater than a predetermined threshold.
 3. The tyre monitoring deviceaccording to claim 2, wherein the processor is configured to: receive acommand via the wireless interface from a third device of the tyremonitoring system; determine a range to the third device; and action thecommand if the range to the third device is less than a predeterminedthreshold.
 4. The tyre monitoring device according to claim 1, whereinthe wireless interface comprises an ultra-wideband interface.
 5. Thetyre monitoring device according to claim 1, wherein the predeterminedthreshold is less than or equal to 40 m.
 6. The tyre monitoring deviceaccording to claim 1, configured to be mounted on an aircraft wheel. 7.A tyre monitoring system comprising a plurality of tyre monitoringdevices according to claim
 1. 8. The tyre monitoring system according toclaim 7, further comprising a control device comprising a wirelesscommunication interface having a range determining capability.
 9. Amethod for a wireless tyre monitoring device, the method comprising:receiving a command via a wireless interface from a second device of thetyre monitoring system; determining a range to the second device; andactioning the command if the range to the second device is less than apredetermined threshold.
 10. A method for a wireless tyre monitoringdevice, the method comprising: receiving data via the wireless interfacefrom a second device of the tyre monitoring system; determining a rangeto the second device; and rejecting the data if the range to the seconddevice is greater than a predetermined threshold.
 11. The methodaccording to claim 10, further comprising: receive a command via thewireless interface from a third device of the tyre monitoring system;determine a range to the third device; and action the command if therange to the third device is less than a predetermined threshold. 12.The method according to claim 9, wherein the wireless interfacecomprises an ultra-wideband interface.
 13. The method according to claim9, wherein the predetermined threshold is less than or equal to 40 m.